Anthropic's Distillation Defenses: What They Change for Claude API Developers

On 12 October 2026 Anthropic published a description of three defenses against AI model distillation attacks: limits on where Claude's reasoning can travel, a classifier that blocks extraction attempts, and tougher handling of repeat offenders.^[1] Most of it concerns Anthropic's own abuse-fighting. Two parts reach into ordinary application code: how you replay conversation history when extended thinking is on, and the fact that a blocked request can now be billed. This piece separates what Anthropic documents from what it only asserts, and lists what an API team should check.

What distillation is, and what Anthropic calls illicit

Distillation is training a smaller or less capable model on the outputs of a stronger one. Anthropic's February 2026 report calls it "a widely used and legitimate training method" and notes that frontier labs routinely distil their own models into cheaper versions for customers.^[2] The concern is the unauthorised form. In the October post Anthropic describes "covert, industrial-scale campaigns to extract the capabilities of one model and replicate them in another," often run through networks of fraudulent accounts, and says the most valuable target is Claude's reasoning transcripts.^[1]

The February report named three labs, DeepSeek, Moonshot and MiniMax, and gave Anthropic's counts of over 16 million exchanges across about 24,000 fraudulent accounts. It also described commercial proxy services in "hydra cluster" arrangements, one of which reportedly managed more than 20,000 accounts at once while mixing extraction traffic with ordinary customer requests.^[2] These are Anthropic's allegations from its own telemetry. We have not seen the labs' responses or independent verification, so we treat them as reported claims.

Anthropic says the attacks have moved from passive use, such as normal requests followed by training on the responses, to active extraction, where prompts try to get Claude to reveal its full reasoning.^[1]

The three defenses

All three rows are taken from the announcement.^[1]

Preserved thinking: the part that touches your code

The API documentation describes preserved thinking as a property of newer Claude models that "guards against distillation." The API checks each returned thinking or redacted_thinking block's signature for two things: whether the model can read the block at all, and whether anything before the block has changed.^[3]

The second check is the one that bites. The system prompt, tools and messages that precede a block form its prefix, and if that prefix differs from what was sent when the block was produced, the block and every later thinking block are invalid. For accounts created on or after 31 August 2026 at 00:00 UTC this check is enforced by default; older accounts enforce it only on requests that set prefix_mismatch_behavior.^[3]

The documentation's guidance reduces to "keep system and tools fixed for the session and treat messages as append-only." Concretely, according to the page:

• Breaks later thinking: changing the system prompt or tool list, editing or reordering earlier messages, clearing or shortening an earlier tool_result, changing an earlier tool_use input, or removing a thinking block from the middle of the history while keeping later ones.
• Safe: appending messages, removing thinking blocks from the start, the end or everywhere (the model loses that reasoning), changing effort, max_tokens or tool_choice, moving cache_control markers, and using server-side compaction or context editing.^[3]

One detail is easy to miss. On Claude Fable 5.1, Opus 5.5, Sonnet 5.5 and Haiku 5.5 the thinking text field is often empty and the signature carries the reasoning, so a serializer that drops "empty" blocks silently discards the model's earlier reasoning.^[3] If your agent loop persists conversations to a database, check that it stores blocks verbatim.

Model readability is a separate rule. Each model reads its own blocks and a fixed set of others; blocks from Sonnet 5.5 and Haiku 5.5 work only in the account that produced them or a linked account, and unreadable blocks are dropped without an error unless you send the beta header.^[3] That header, thinking-binding-controls-2026-08-01, adds a block_binding.prefix_mismatch_behavior setting: "error" returns a 400, while "drop_block" drops the failing blocks and all later ones. The page calls the latter a stopgap that can significantly increase output tokens.^[3]

Our interpretation: the design makes a stolen or exported reasoning trace hard to reuse elsewhere, because it is bound to a model and a conversation prefix. For legitimate developers the price is discipline about history. Patterns that rewrote earlier turns, such as injecting fresh values into the first user message each turn, now cost reasoning continuity. The documentation suggests mid-conversation system messages and tool addition or removal blocks as cleaner alternatives.^[3]

The classifier, and what is known about its error rate

The announcement says the two-stage classifier was red-teamed internally and externally and that fixes were applied. It reports a false-positive rate below 0.1% in the relevant areas, and admits that legitimate users sometimes have to update integrations.^[1]

The classifier's design comes from Anthropic's constitutional classifiers research. That January 2026 post describes a cascade: a lightweight probe on the model's internal activations screens all traffic, and flagged exchanges go to a more capable classifier that reads input and output together. Its reported figures, which were for jailbreak defense on Sonnet 4.5 traffic and not for distillation, were a 0.05% refusal rate on harmless queries over one month and roughly 1% compute overhead as a projection.^[4] We cannot say the distillation classifier has the same profile. The October post says only that it is "based on" this research.^[1]

What is Anthropic's evidence, and what is not

The announcement mixes measurements with context. Sorting them:

• Anthropic's own early evidence: the 90-99% reduction in data harvested by distillers, which it labels "early evidence"; its estimate of a 10-100x drop in reasoning tokens extractable on its platform; ban counts; and the sub-0.1% false-positive rate.^[1]
• A usefulness test: Anthropic reports that a pretrained model trained on full Claude Opus 4.8 transcripts scored 80.4% on SWE-bench Verified, against 71.8% when trained on summarised transcripts. This is an internal experiment, and the post's argument is that summarising reasoning removes much of its training value.^[1]
• Admitted unknowns: Anthropic writes that it does not know how long the gains will last, expects a "cat-and-mouse game," and says it has "yet to see a highly sophisticated and persistent attempt to circumvent them."^[1]

For context on how to weigh numbers like these, see how to read an AI benchmark claim. The same caution applies to any vendor's description of its own safeguards.

A checklist for API teams

1. Audit conversation replay. Confirm assistant turns, including thinking blocks, are stored and returned byte for byte. Do not filter empty thinking blocks.
2. Freeze system and tools per session. Version changes should start a new conversation, not edit a running one.
3. Handle the error path. On new accounts a prefix mismatch returns a 400 by default. Decide deliberately whether to rebuild the session or opt in to drop_block, knowing the token cost.^[3]
4. Look at your prompts. Requests asking Claude to translate, restate or tag its earlier reasoning resemble extraction patterns Anthropic says it has blocked.^[1]
5. Watch your bill and error logs. Anthropic says blocked requests are charged. If you resell or proxy access, read the provider's usage terms first; see what the 2026 usage policy changes.
6. Plan for model switches. Whether a new model can read your stored blocks depends on the model pair and the account, so test a switch before relying on carried-over reasoning.^[3]

For background on the reasoning features involved, see reasoning models, thinking tokens and cost and AI agent memory, compaction and context editing.

What remains uncertain

We did not read the September threat intelligence report that the announcement cites, so the specific cases it names, including those involving Zhipu and Moonshot, are Anthropic's account as relayed in the October post, not something we checked. We also have not tested the defenses ourselves: nothing here is "in our testing." The effect on third-party agents that legitimately inspect model reasoning is not quantified in any source we opened. And because the API documentation changes quickly, check the preserved-thinking page directly before you change production code; this article reflects it as read on 25 October 2026.